﻿using System.Collections.Generic;

using System.Linq;
using System.Security.Claims;
namespace DX.Security
{
    // 定义资源描述符类（增强版）
    public class ResourceDescriptor
    {
        public IEnumerable<Claim> Claims { get; set; }
        public IEnumerable<string> AllowedActions { get; set; } // 新增动作白名单

        public ResourceDescriptor(IEnumerable<Claim> claims)
        {
            Claims = claims;
            AllowedActions = Enumerable.Empty<string>(); // 默认允许所有动作
        }

        public bool HasClaim(string claimType, string claimValue)
        {
            return Claims.Any(c => c.Type == claimType && c.Value == claimValue);
        }
    }

    // 定义主体类
    public class Subject
    {
        public ClaimsIdentity Identity { get; set; }
    }

    // 定义访问请求类
    public class AccessRequest
    {
        public Subject Subject { get; set; }
        public ResourceDescriptor Resource { get; set; }
        public string Action { get; set; }
    }

    // 定义 ABAC 策略类
    public class AbacPolicy
    {
        public int Id { get; set; }
        public IList<Claim> SubjectClaims { get; set; }
        public IList<Claim> ResourceClaims { get; set; }
        public string Action { get; set; }
        public bool IsAllowed { get; set; }
    }


}